1 files changed, 10 insertions, 1 deletions
diff --git a/WebCore/rendering/TextControlInnerElements.cpp b/WebCore/rendering/TextControlInnerElements.cpp
index f9641f4..6495d04 100644
--- a/WebCore/rendering/TextControlInnerElements.cpp
+++ b/WebCore/rendering/TextControlInnerElements.cpp
@@ -124,6 +124,11 @@ void TextControlInnerElement::attachInnerElement(Node* parent, PassRefPtr<Render
         parent->renderer()->addChild(renderer);
 }
 
+bool TextControlInnerElement::isSpellCheckingEnabled() const
+{
+    return m_shadowParent && m_shadowParent->isSpellCheckingEnabled();
+}
+
 // ----------------------------
 
 inline TextControlInnerTextElement::TextControlInnerTextElement(Document* document, HTMLElement* shadowParent)
@@ -142,7 +147,11 @@ void TextControlInnerTextElement::defaultEventHandler(Event* event)
     // Then we would add one to the text field's inner div, and we wouldn't need this subclass.
     // Or possibly we could just use a normal event listener.
     if (event->isBeforeTextInsertedEvent() || event->type() == eventNames().webkitEditableContentChangedEvent) {
-        if (Node* shadowAncestor = shadowAncestorNode())
+        Node* shadowAncestor = shadowAncestorNode();
+        // A TextControlInnerTextElement can be its own shadow ancestor if its been detached, but kept alive by an EditCommand.
+        // In this case, an undo/redo can cause events to be sent to the TextControlInnerTextElement.  
+        // To prevent an infinite loop, we must check for this case before sending the event up the chain.
+        if (shadowAncestor && shadowAncestor != this)
             shadowAncestor->defaultEventHandler(event);
     }
     if (event->defaultHandled())